Ensure only SNMPv3 is enabled

检查方式

审计方法: 配置正则匹配

匹配模式

(?ms)^config system snmp sysinfo\n(?:[ \t]+[^\n]*\n)*?[ \t]+set status enable[ \t]*\n.*?^config system snmp community\nend[ \t]*$.*?^config system snmp user\n[ \t]+edit

修复方式

修复方法: 操作指南或基础设施补丁

config system snmp sysinfo set status enable end config system snmp community delete <id> end config system snmp user edit "snmp_v3" set security-level auth-priv set auth-proto sha256 set auth-pwd <password> set priv-proto aes256 set priv-pwd <password> next end # CIS guidance: To enable SNMP agent in CLI: config system snmp sysinfo set status enable end In GUI, go to System > SNMP and enable SNMP Agent. To delete SNMPv1/2c communities. In this example, we'll delete community "public" in CLI: First, to identify the community, run config system snmp community show config system snmp community edit 1 set name "public" config hosts edit 1 next end next end This shows that the community public has ID 1 config system snmp community delete 1 end In the GUI, go to: System > SNMP, select the community and click on the Delete button. To add SNMPv3 user in CLI: config system snmp user edit "snmp_test" set security-level auth-priv set auth-proto sha256 set auth-pwd xxxx set priv-proto aes256 set priv_pwd xxxx end In the GUI, go to: 1. System > SNMP, under SNMPv3, click on "Create New" button. 2. Select "Authentication" and choose SHA256 as Authentication algorithm. 3. Click "Change" to type in the password. 4. Also select option "Private", choose AES256 as Encryption Algorithm. 5. Click on "Change" to change the password. Click "OK" to add the new user. 6. Click apply to apply the new setting into the current config.

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

tmaegis scan --target fortigate